CIFS over firewall

[David Connolly]

Hello, can someone point me towards relevant documentation on running a CIFS mount over a firewall? Specifically, I'm looking for guidance on port numbers, windows/netbios authentication methods and any other "gotchas" in using this protocol in a secured network.

Thanks in advance.

[Luk Vandenbussche · Accepted solution]

David,

These are the ports used by cifs

UDP/137 - used by nmbd
UDP/138 - used by nmbd
TCP/139 - used by smbd
TCP/445 - used by smbd

[David Connolly]

Thanks Luk. In my proposed solution, the remote share will reside on Windows server that is a member of a domain. Will I need to access the PDC in order to authenticate, or does that server "relay" the authentication to the PDC?

Basically, do I need to open those ports between my target server and the PDC?

[Bill Hassell]

Netbios doesn't route very well but CIFS (just like NFS) is the worst possible security risk I can imagine for sharing your data. CIFS is simply not a secure protocol and is easily sniffed as well as compromised. If you have a secure network, adding CIFS capability will eliminate that quality. If you must share data over the Internet, use a VPN and CIFS will safe and very easy easy to share.

[David Connolly]

Thanks Bill. I am well aware of the security risks involved. The DMZ is not touching the internet, rather it is a staging ground between another DMZ and the private LAN. Checkpoint have specific protocol-aware products for managing CIFS over the firewall which go some way towards managing the risk.